Quantile differential privacy noise adding method and device, medium, equipment and product

Abstract

The invention discloses a quantile differential privacy noise adding method and device, a medium, equipment and a product. The method comprises the steps that according to a preset expression of a user-defined aggregation function UDAF, a plurality of numerical values to be aggregated are obtained, the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function comprise the expression and a target quantile; and selecting a target numerical value corresponding to the target quantile from the plurality of numerical values by using a differential privacy index mechanism to obtain a noise-added quantile value of the quantile function. Therefore, the differential privacy noise adding process can be efficient and controllable, the noise adding error influence can be reduced while the safety is not influenced, and the availability of the query result is improved. Besides, when the SQL statement is rewritten, the quantile function containing the noise adding logic is achieved in a UDAF mode, and the problems that rewriting of the SQL statement is complex, and the running error rate of the rewritten SQL statement is high can be solved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a quantile differential privacy noise adding method, device, medium, equipment and product. Background Art

[0002] Differential Privacy (DP) is a privacy protection method, mainly used to protect aggregated statistical data. It can protect sensitive information while maintaining the stability of the overall statistical characteristics of the data. Its main approach is to add an appropriate amount of noise to the statistical results to ensure that modifying a record in the data will not have a significant impact on the statistical results, aiming to solve the problem of data leakage in the statistical release process.

[0003] For the scenario of Structured Query Language (SQL) analysis query, there are two main ways to add differential privacy noise: rewrite noise (mapping the noise logic in the SQL statement) and post-processing noise (adding noise after obtaining the query results). Percentile is a common SQL aggregation function, which is very common in data analysis scenarios in fields such as advertising and finance. In order to protect the privacy and security of detailed data in these scenarios, Laplace's post-processing noise is usually used to add differential privacy noise to the quantile function, but the noise error of this method is relatively large, affecting the availability of query results. Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides a quantile differential privacy noise adding method, the method comprising:

[0006] According to an expression of a preset user-defined aggregation function UDAF, a plurality of values ​​to be aggregated are obtained, wherein the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function both include the expression and a target quantile;

[0007] A target value corresponding to the target quantile is selected from the multiple values ​​by using a differential privacy index mechanism to obtain a noisy quantile value of the quantile function.

[0008] In a second aspect, the present disclosure provides a quantile differential privacy noise adding device, the device comprising:

[0009] An acquisition module, used for acquiring multiple values ​​to be aggregated according to an expression of a preset user-defined aggregation function UDAF, wherein the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function both include the expression and the target quantile;

[0010] A selection module is used to select a target value corresponding to the target quantile from the multiple values ​​by using a differential privacy index mechanism to obtain a noisy quantile value of the quantile function.

[0011] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the quantile differential privacy noising method provided in the first aspect of the present disclosure.

[0012] In a fourth aspect, the present disclosure provides an electronic device, including:

[0013] a storage device having a computer program stored thereon;

[0014] A processing device is used to execute the computer program in the storage device to implement the steps of the quantile differential privacy noising method provided in the first aspect of the present disclosure.

[0015] In a fifth aspect, the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the quantile differential privacy noising method provided in the first aspect of the present disclosure.

[0016] In the above technical solution, when the noise point includes the quantile function, the quantile function is replaced in advance with a user-defined aggregation function UDAF to achieve the rewriting of the SQL statement, and then the rewriting and noise addition of the quantile function is achieved based on the exponential mechanism, wherein the query result error can be controlled within a small range by adjusting the utility function and security parameters of the exponential mechanism, making the differential privacy noise addition process efficient and controllable, and being able to reduce the impact of the noise addition error without affecting security, and improve the availability of the query results. In addition, when rewriting the SQL statement, the quantile function containing the noise addition logic is implemented through the UDAF method, rather than directly adding the exponential mechanism algorithm logic to the original query statement through the SQL expression, thereby avoiding the problem of complex SQL statement rewriting and high error rate of the rewritten SQL statement.

[0017] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0019] Figure 1 The figure is a flowchart of a quantile differential privacy noise adding method according to an exemplary embodiment.

[0020] Figure 2 It is a schematic diagram of a quantile differential privacy noising process according to an exemplary embodiment.

[0021] Figure 3 is a flowchart of a quantile differential privacy noise adding method according to another exemplary embodiment.

[0022] Figure 4 The diagram is a hierarchical diagram of a SQL statement according to an exemplary embodiment.

[0023] Figure 5 is a flowchart of a quantile differential privacy noise adding method according to another exemplary embodiment.

[0024] Figure 6 It is a block diagram of a quantile differential privacy noising device according to an exemplary embodiment.

[0025] Figure 7 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0029] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0030] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0032] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0033] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's information. Thus, the user can autonomously choose whether to provide information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0034] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide information to the electronic device.

[0035] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0036] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0037] Figure 1 FIG. 1 is a flowchart of a quantile differential privacy noise adding method according to an exemplary embodiment. Figure 1 As shown, the quantile differential privacy noise adding method may include the following S101 and S102.

[0038] In S101, multiple values ​​to be aggregated are obtained according to an expression of a preset user-defined aggregation function UDAF. UDAF is obtained by replacing the quantile function in advance. The parameters of UDAF and the quantile function are the expression and the target quantile.

[0039] In S102, a target value corresponding to a target quantile is selected from multiple values ​​using a differential privacy index mechanism to obtain a noisy quantile value of a quantile function.

[0040] In the present disclosure, the differential privacy noise addition method can be used to implement differential privacy noise addition of percentiles, and the percentile function containing noise addition logic can be implemented by a user-defined aggregate function (UDAF). Among them, the percentile function is a statistical function, which is used to determine the value of a specific quantile in a data set, that is, the target quantile value. The calculation logic of the percentile(expr,p) function is to sort the expr results first, and then output the p quantile value of the sorted results, where expr and p are the parameters of the percentile function, expr is an expression, and p is the target quantile. For example, percentile(val,0.5) means calculating the value of the 50% quantile after sorting the val column.

[0041] The expression expr can be a reference to a column in the database table of the data provider, or a more complex calculation expression, for example:

[0042] Directly reference the column name: percentile(salary,0.5), where salary is a column name in the database table.

[0043] Use the calculation expression: percentile(salary*1.1,0.5), where salary*1.1 is an expression that means multiplying each value in the salary column by 1.1.

[0044] like Figure 2As shown in the figure, the processing logic based on the combination of the noise service and UDAF can be used to implement the differential privacy noise of quantiles. Among them, the SQL statement parsing and noise point screening functions can be integrated separately in the noise service, and the differential privacy noise processing implementation process can be integrated into the UDAF calculation to meet the needs of overall analysis of SQL statements and noise processing for noise points.

[0045] The above-mentioned quantile differential privacy noise adding method can be applied to data providers. After receiving the SQL statement input by the user, the data provider can use the noise adding service to implement SQL statement parsing, noise point screening, and SQL statement rewriting to obtain a new SQL statement. When the noise point includes a quantile function, the SQL statement rewriting includes replacing the quantile function belonging to the noise point with a preset UDAF, such as Figure 2 As shown in the figure, the quantile function percentile(expr,p) belonging to the noise point is replaced with the user-defined aggregation function dp-percentile(expr,p) to obtain a new SQL statement through the noise service.

[0046] For example, replace the SQL statement "Select percentile(val,0.9)frominput_a" with "Select dp_percentile(val,0.9)frominput_a", where input_a is a table name.

[0047] When the above-mentioned preset UDAF is included in the noise-added points of the new SQL statement, the UDAF calculation can be performed. Specifically, multiple values ​​to be aggregated can be obtained according to the expression of the UDAF. Then, the target value corresponding to the target quantile is selected from the multiple values ​​using the differential privacy index mechanism, and the target value is determined as the quantile value of the quantile function after noise addition.

[0048] In the above technical solution, when the noise point includes the quantile function, the quantile function is replaced in advance with a user-defined aggregation function UDAF to achieve the rewriting of the SQL statement, and then the rewriting and noise addition of the quantile function is achieved based on the exponential mechanism, wherein the query result error can be controlled within a small range by adjusting the utility function and security parameters of the exponential mechanism, making the differential privacy noise addition process efficient and controllable, and being able to reduce the impact of the noise addition error without affecting security, and improve the availability of the query results. In addition, when rewriting the SQL statement, the quantile function containing the noise addition logic is implemented through the UDAF method, rather than directly adding the exponential mechanism algorithm logic to the original query statement through the SQL expression, thereby avoiding the problem of complex SQL statement rewriting and high error rate of the rewritten SQL statement.

[0049] In addition, the above-mentioned noise addition service can be performed locally by the data provider, or by a noise addition service provider that provides the noise addition service. In one embodiment, the above-mentioned noise addition service can be performed locally by the data provider. In this case, Figure 3 As shown, before the above S101, the above quantile differential privacy noise adding method may also include the following S103.

[0050] In S103 , in response to receiving a structured query language SQL statement, a noise point in the SQL statement is identified, and a quantile function belonging to the noise point is replaced with a UDAF to obtain a new SQL statement.

[0051] In the present disclosure, the data provider may deploy a database engine locally, which is used to perform UDAF calculation operations. At this time, the above S101 may include: calling the local database engine to obtain multiple values ​​to be aggregated according to the UDAF expression in the new SQL statement; the above S102 may include: using the database engine to select a target value corresponding to the target quantile from multiple values ​​using the differential privacy index mechanism to obtain the quantile value of the quantile function and the noise added.

[0052] Specifically, if Figure 2 As shown, after receiving the SQL statement input by the user, the data provider can parse the SQL statement, for example, using antlr (another tool for language recognition) to parse it to obtain the Abstract Syntax Tree (AST) corresponding to the SQL statement; then, according to the abstract syntax tree, identify the noise points in the SQL statement and select a suitable noise adding mechanism; according to the identified noise points and their noise adding mechanism, rewrite the SQL statement, for example, if the noise point is a percentile function, replace its expression from percentile(expr,p) to dp_percentile(expr,p).

[0053] Among them, ANTLR refers to an open source syntax analyzer that can automatically generate a syntax tree based on input and display it visually. AST is an abstract representation of the syntax structure of the source code. It represents the syntax structure of the programming language in a tree form. Each node on the syntax tree represents a structure in the source code.

[0054] The following is a detailed description of the specific implementation method of identifying the noise points in the SQL statement and selecting a suitable noise adding mechanism according to the abstract syntax tree. Specifically, it can be achieved through the following steps [1] to [3].

[0055] Step [1]: Analyze the syntax tree structure and divide it according to the nested levels.

[0056] For example, a SQL statement such as Figure 4 As shown, it includes 2 levels, namely, layer 1, layer 2.1 and layer 2.2.

[0057] Step [2]: Noise point screening. Specifically, the aggregation nodes that need to be noised can be screened in accordance with the noise addition rule requirements. For example, when there are nested aggregation functions, the inner layer is noised first, and the outer layer aggregation function is not noised, for example, sum(avg(val)+noise).

[0058] Step [3]: Analyze the noise node function type and its internal expression type, and select the appropriate noise mechanism.

[0059] In another embodiment, the above-mentioned noise addition service can be performed by the noise addition service provider, that is, the data provider can use the noise addition service provider to perform the noise addition service. In this way, not only can the security features of the noise addition service provider, such as hardware security module or trusted execution environment, be used to improve the security of data processing, but also the problem that the data provider's performance is affected by the local operation of the noise addition service by the data provider can be avoided, thereby improving the SQL query performance of the data provider. When the noise addition service is performed by the noise addition service provider, such as Figure 5 As shown, before the above S101, the above quantile differential privacy noise adding method may also include the following S104.

[0060] In S104, in response to receiving a structured query language SQL statement, the SQL statement is sent to a noise adding service provider so that the noise adding service provider can identify the noise points in the SQL statement, replace the quantile function belonging to the noise point with UDAF, obtain a new SQL statement, and send the new SQL statement to the data provider.

[0061] After receiving the structured query language SQL statement input by the user, the data provider may send the SQL statement to the noise adding service provider; after receiving the SQL statement, the noise adding service provider may call the local database engine to obtain multiple values ​​to be aggregated according to the UDAF expression in the new SQL statement, and select the target value corresponding to the target quantile from the multiple values ​​by using the differential privacy index mechanism through the database engine to obtain the quantile value of the quantile function after noise. That is, the above S101 may include: in response to receiving the new SQL statement, calling the local database engine to obtain multiple values ​​to be aggregated according to the UDAF expression in the new SQL statement; the above S102 may include: selecting the target value corresponding to the target quantile from the multiple values ​​by using the differential privacy index mechanism through the database engine to obtain the quantile value of the quantile function after noise.

[0062] The following is a detailed description of the specific implementation method of selecting a target value corresponding to a target quantile from multiple values ​​using the differential privacy index mechanism in the above S102. Specifically, it can be achieved by the following steps (1) to (3).

[0063] Step (1): Count the frequency of occurrence of each value, and construct a value-frequency pair based on the frequency of occurrence of each value.

[0064] In this disclosure, Figure 2 As shown, after obtaining multiple values ​​through the preset UDAF expression, these values ​​can be traversed one by one to count the occurrence frequency of each value, and a value-frequency pair can be constructed according to the occurrence frequency of each value.

[0065] For example, multiple values ​​obtained by the preset UDAF expression include 1.2, 0.2, 2.2, 0.2, 1.3, 1.3, and 0.2. Through frequency statistics, it can be seen that the occurrence frequencies of 1.2 and 2.2 are both 1, the occurrence frequency of 0.2 is 3, and the occurrence frequency of 1.3 is 2. Therefore, the following four value-frequency pairs can be constructed: (1.2, 1), (2.2, 1), (0.2, 3), and (1.3, 2).

[0066] When the magnitude of multiple values ​​obtained through the preset UDAF expression is large, in order to improve the efficiency of constructing value-frequency pairs, these values ​​can be grouped, and for each group, the frequency of occurrence of each value in the group is counted, and based on the frequency of occurrence of each value, the value-frequency pair corresponding to the group is constructed; then, the value-frequency pairs corresponding to each group are aggregated to obtain the value-frequency pairs corresponding to the above multiple values.

[0067] Step (2): Arrange the value-frequency pairs in order from small to large.

[0068] like Figure 2 As shown, after obtaining the value-frequency pairs, these value-frequency pairs can be arranged in order from small to large values.

[0069] For example, the value-frequency pairs include (1.2, 1), (2.2, 1), (0.2, 3), and (1.3, 2). Arrange them in ascending order of value, and the resulting value-frequency pairs are (0.2, 3), (1.2, 1), (1.3, 2), and (2.2, 1).

[0070] Step (3): Use the differential privacy index mechanism to select the target value corresponding to the target quantile from the value-frequency pairs obtained after sorting.

[0071] like Figure 2 As shown in FIG. 1 , after sorting the value-frequency pairs, the differential privacy index mechanism can be used to select the target value corresponding to the target quantile from the sorted value-frequency pairs, and output the target value as the query result.

[0072] In a possible implementation, a differential privacy index mechanism can be used to select a target value corresponding to a target quantile from the value-frequency pairs obtained after sorting through the following steps (31) to (34).

[0073] Step (31): Determine the ranking position of each value based on the value-frequency pairs obtained after sorting.

[0074] In the present disclosure, the sorting position is used to characterize the position (for example, serial number) of the corresponding numerical value when multiple numerical values ​​are sorted from small to large. For each numerical value-frequency pair in the numerical value-frequency pair obtained after sorting, the sorting position of the numerical value in the numerical value-frequency pair can be determined according to the frequency of occurrence of each numerical value frequency pair that is located before the numerical value-frequency pair in the numerical value-frequency pair obtained after sorting.

[0075] Specifically, the sum of the occurrence frequencies of the value-frequency pairs before the value-frequency pair obtained after sorting can be determined first, and then 1 is added to the sum to obtain the sorting position of the value in the value-frequency pair.

[0076] For example, the value-frequency pairs obtained after sorting are (0.2, 3), (1.2, 1), (1.3, 2), and (2.2, 1), where the ranking position of 0.2 is 1, the ranking position of 1.2 is 4, the ranking position of 1.3 is 5, and the ranking position of 2.2 is 7.

[0077] Step (32): Determine the utility function and the sensitivity of the utility function of the differential privacy index mechanism based on the ranking position and target quantile of each value.

[0078] In the present disclosure, the utility function q(D, r) is used to define the quality of an output result (ie, a value) r on a data set D.

[0079] Step (33): Determine the target position of the target value based on the utility function and sensitivity.

[0080] Step (34): According to the target position, determine the target value from the value-frequency pairs obtained after sorting.

[0081] The following is a detailed description of the specific implementation method of determining the utility function and the sensitivity of the utility function of the differential privacy index mechanism according to the ranking position and target quantile of each value in the above step (32). Specifically, it can be achieved through the following steps (321) to (325).

[0082] Step (321): Determine the number of multiple values ​​according to the frequency of occurrence of each value.

[0083] Specifically, the sum of the occurrence frequencies of the respective values ​​in the value-frequency pairs obtained after sorting may be determined as the number of the plurality of values.

[0084] Step (322): Determine the quantile position corresponding to the target quantile according to the target quantile and the number of multiple values.

[0085] For example, the quantile position corresponding to the target quantile can be determined according to the target quantile and the number of multiple values ​​by the following equation:

[0086] P=p*(k+1)

[0087] Among them, P is the quantile position corresponding to the target quantile; k is the number of multiple values.

[0088] Step (323): Calculate the distance between each ranking position and the quantile position respectively.

[0089] In the present disclosure, for each ranking position, the absolute value of the difference between the ranking position and the quantile position corresponding to the target quantile may be determined as the distance between the ranking position and the quantile position corresponding to the target quantile.

[0090] Step (324): Based on all distances, construct a utility function of the differential privacy index mechanism so that the result of the utility function is negatively correlated with the distance.

[0091] The present disclosure designs a utility function of a differential privacy index mechanism according to the distance between each ranking position and the quantile position, so that the result of the utility function is negatively correlated with the distance, that is, the greater the distance between the ranking position and the quantile position, the lower the result of the utility function, and the lower the probability that the ranking position is selected; the closer the distance between the ranking position and the quantile position, the higher the result of the utility function, and the higher the probability that the ranking position is selected.

[0092] For example, q(D, r) = e -λP-d(r) , where λ is a constant greater than zero, used to control the decay rate of the utility function, d(r) represents the ranking position of the value r, and |Pd(r)| represents the distance between the ranking position d(r) of the feature value r and the quantile position P.

[0093] Step (325): Calculate the sensitivity of the utility function.

[0094] In the present disclosure, the sensitivity Δq of the utility function refers to the maximum difference between the results of the utility function on two data sets D and D' that differ by one data point, where the data set D' differs by one data point from the data set D. Combined with the definition of the utility function above, we find that when a piece of data is added / deleted from the original data set, the change in the quantile position corresponding to the target quantile is at most 1, that is, the sensitivity of the utility function is 1.

[0095] The following is a detailed description of the specific implementation method of determining the target position of the target value according to the utility function and sensitivity in the above step (33). Specifically, it can be achieved through the following steps (331) to (333).

[0096] Step (331): Determine multiple candidate positions from all sorted positions.

[0097] Step (332): For each candidate position, determine the selection probability of the candidate position based on the utility function and sensitivity.

[0098] In the present disclosure, in conjunction with the definition of the exponential mechanism, the function e can be considered x The functional form of The probability of each candidate position being selected is calculated and normalized to obtain the selection probability of each candidate position, where ε is the privacy budget.

[0099] Step (333): According to the selection probabilities of the multiple candidate positions, a candidate position is randomly selected from the multiple candidate positions as the target position.

[0100] The specific implementation of determining multiple candidate positions from all sorted positions in the above step (331) is described in detail below. Specifically, it can be implemented through multiple implementations. In one implementation, all sorted positions can be determined as candidate positions.

[0101] In another embodiment, the sorted positions whose distances between the quantile positions corresponding to the target quantile are less than a preset distance may be determined as candidate positions.

[0102] In the present disclosure, combined with the definition analysis of the quantile function, it is found that the effect of adding, reducing, or modifying a row in the original data set on the final value is only related to the data within a certain range before and after the target quantile value in the original data set, where the target quantile value is the value at the quantile position corresponding to the target quantile among the above multiple values. Therefore, based on this discovery, the above multiple values ​​can be screened, and only some values ​​that have a greater impact on the query results can be used as candidate values. Specifically, the sorting position whose distance between the quantile position corresponding to the target quantile is less than a preset distance (for example, 5) can be determined as a candidate position.

[0103] In this implementation, multiple sorting positions are screened to achieve the screening of multiple values, thereby reducing the amount of calculation in the application of the index mechanism and improving the efficiency of differential privacy noise addition. At the same time, since the values ​​that have a greater impact on the query results are screened out from multiple values, the probability of irrelevant values ​​being selected can be further avoided, thereby improving the availability of the query results.

[0104] In another embodiment, the sorted positions whose distances between the quantile positions corresponding to the target quantile are less than a preset distance may be determined as candidate positions; if the current number of candidate positions is less than a preset number, the target number of quantile positions are determined as candidate positions.

[0105] In the present disclosure, the target number is equal to the difference between the preset number and the current number. After filtering out the positions within a certain range before and after the quantile position corresponding to the target quantile by distance, if the number of the screened candidate positions is less than the preset number (for example, 10), the quantile position corresponding to the target quantile can be used to fill in the position to increase the proportion of the target quantile value, so as to further improve the availability of the query results.

[0106] The following is a detailed description of a specific implementation method of determining the target value from the value-frequency pairs obtained after sorting according to the target position in the above step (34). Specifically, it can be implemented through a variety of implementation methods. In one implementation method, a value corresponding to the target position can be determined from the value-frequency pairs obtained after sorting as the target value.

[0107] Specifically, the occurrence frequency of the first value-frequency pair in the value-frequency pairs obtained after sorting can be compared with the target position; if the occurrence frequency of the first value-frequency pair is greater than or equal to the target position, the value in the first value-frequency pair is determined as the value corresponding to the target position, and the value corresponding to the target position is determined as the target value; if the occurrence frequency of the first value-frequency pair is less than the target position, the sum of the occurrence frequencies of the first two value-frequency pairs in the value-frequency pairs obtained after sorting is compared with the target position; if the sum of the occurrence frequencies is greater than or equal to the target position, the value in the second value-frequency pair in the value-frequency pairs obtained after sorting is determined as the value corresponding to the target position, and the value corresponding to the target position is determined as the target value; if the sum of the occurrence frequencies is less than the target position, the sum of the occurrence frequencies of the first three value-frequency pairs in the value-frequency pairs obtained after sorting is compared with the target position, ..., and so on, until the target value is found.

[0108] For example, the target position is 5, and the value-frequency pairs obtained after sorting are (0.2, 3), (1.2, 1), (1.3, 2), and (2.2, 1), then the target value is 1.3.

[0109] For another example, the target position is 2, and the value-frequency pairs obtained after sorting are (0.2, 3), (1.2, 1), (1.3, 2), and (2.2, 1), then the target value is 0.2.

[0110] In another embodiment, the target value can be determined from the value-frequency pairs obtained after sorting according to the target position through the following steps (341) to (346).

[0111] Step (341): Determine the value corresponding to the target position from the value-frequency pairs obtained after sorting as the first value.

[0112] Step (342): Determine whether the first value is from the last value-frequency pair among the value-frequency pairs obtained after sorting.

[0113] In the present disclosure, if the first value does not come from the last value-frequency pair among the value-frequency pairs obtained after sorting, the following steps (343) to (345) are executed; if the first value comes from the last value-frequency pair among the value-frequency pairs obtained after sorting, the following step (346) is executed.

[0114] Step (343): Determine the value corresponding to the next position of the target position from the value-frequency pairs obtained after sorting as the second value, and generate a random number in the range of (0, 1).

[0115] Step (344): using a random number to perturb the difference between the second value and the first value.

[0116] For example, the disturbance processing result is a calculation result of the random number×(the second value and the first value).

[0117] Step (345): Determine the sum of the disturbance processing result and the first value as the target value.

[0118] Step (346): Determine the first value as the target value.

[0119] In the above implementation, the differential privacy noise addition result is perturbed by a random function, which can further improve data privacy.

[0120] Figure 6 FIG. 1 is a block diagram of a quantile differential privacy noise adding device according to an exemplary embodiment. Figure 6 As shown, the quantile differential privacy noise adding device 300 includes:

[0121] An acquisition module 301 is used to acquire multiple values ​​to be aggregated according to an expression of a preset user-defined aggregation function UDAF, wherein the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function both include the expression and the target quantile;

[0122] The selection module 302 is used to select a target value corresponding to the target quantile from the multiple values ​​by using a differential privacy index mechanism to obtain a noisy quantile value of the quantile function.

[0123] In the above technical solution, when the noise point includes the quantile function, the quantile function is replaced in advance with a user-defined aggregation function UDAF to achieve the rewriting of the SQL statement, and then the rewriting and noise addition of the quantile function is achieved based on the exponential mechanism, wherein the query result error can be controlled within a small range by adjusting the utility function and security parameters of the exponential mechanism, making the differential privacy noise addition process efficient and controllable, and being able to reduce the impact of the noise addition error without affecting security, and improve the availability of the query results. In addition, when rewriting the SQL statement, the quantile function containing the noise addition logic is implemented through the UDAF method, rather than directly adding the exponential mechanism algorithm logic to the original query statement through the SQL expression, thereby avoiding the problem of complex SQL statement rewriting and high error rate of the rewritten SQL statement.

[0124] Optionally, the selection module 302 includes:

[0125] A statistical submodule, used to count the occurrence frequency of each of the numerical values, and construct a numerical value-frequency pair according to the occurrence frequency of each of the numerical values;

[0126] A sorting submodule, used to arrange the value-frequency pairs in order from small to large values;

[0127] A selection submodule is used to select a target value corresponding to the target quantile from the value-frequency pairs obtained after sorting by using a differential privacy index mechanism.

[0128] Optionally, the selection submodule includes:

[0129] A first determination submodule is used to determine the sorting position of each of the numerical values ​​according to the numerical value-frequency pairs obtained after sorting, wherein the sorting position is used to represent the position of the corresponding numerical value when the multiple numerical values ​​are sorted from small to large;

[0130] A second determination submodule, configured to determine a utility function of a differential privacy index mechanism and a sensitivity of the utility function according to a ranking position of each of the numerical values ​​and the target quantile;

[0131] A third determination submodule, configured to determine a target position of the target value according to the utility function and the sensitivity;

[0132] The fourth determination submodule is used to determine the target value from the value-frequency pairs obtained after the sorting according to the target position.

[0133] Optionally, the second determining submodule includes:

[0134] a fifth determining submodule, configured to determine the number of the plurality of values ​​according to the occurrence frequency of each of the values;

[0135] a sixth determination submodule, configured to determine a quantile position corresponding to the target quantile according to the target quantile and the quantity;

[0136] A first calculation submodule, used for respectively calculating the distance between each of the sorting positions and the quantile position;

[0137] A construction submodule, configured to construct a utility function of a differential privacy index mechanism according to all the distances, so that a result of the utility function is negatively correlated with the distance;

[0138] The second calculation submodule is used to calculate the sensitivity of the utility function.

[0139] Optionally, the third determining submodule includes:

[0140] A seventh determination submodule, used to determine a plurality of candidate positions from all the sorted positions;

[0141] an eighth determination submodule, configured to determine, for each candidate position, a selection probability of the candidate position according to the utility function and the sensitivity;

[0142] The random selection submodule is used to randomly select a candidate position from the multiple candidate positions as the target position according to the respective selection probabilities of the multiple candidate positions.

[0143] Optionally, the seventh determining submodule includes:

[0144] The ninth determination submodule is used to determine the sorting position whose distance between the quantile position corresponding to the target quantile is less than a preset distance as the candidate position.

[0145] Optionally, the seventh determining submodule further includes:

[0146] The tenth determination submodule is used to determine the percentile positions of the target number as the candidate positions if the current number of the candidate positions is less than a preset number, wherein the target number is equal to the difference between the preset number and the current number.

[0147] Optionally, the fourth determination submodule is used to determine a value corresponding to the target position from the value-frequency pairs obtained after the sorting as the target value.

[0148] Optionally, the fourth determining submodule includes:

[0149] an eleventh determination submodule, configured to determine a value corresponding to the target position from the value-frequency pairs obtained after the sorting, as a first value;

[0150] A twelfth determination submodule is used for determining, if the first value is not from the last value-frequency pair among the value-frequency pairs obtained after the sorting, a value corresponding to the next position of the target position from the value-frequency pairs obtained after the sorting as a second value, and generating a random number in the range of (0, 1);

[0151] a disturbance processing submodule, configured to perform a disturbance processing on the difference between the second value and the first value using the random number;

[0152] The thirteenth determination submodule is used to determine the sum of the disturbance processing result and the first value as the target value.

[0153] Optionally, the fourth determining submodule further includes:

[0154] A fourteenth determination submodule is configured to determine the first value as the target value if the first value comes from the last value-frequency pair.

[0155] Optionally, the quantile differential privacy noise adding device 300 further includes:

[0156] A sending module, configured to, in response to receiving a structured query language SQL statement, send the SQL statement to a noise adding service provider, so that the noise adding service provider can identify a noise point in the SQL statement, replace a quantile function belonging to the noise point with the UDAF, obtain a new SQL statement, and send the new SQL statement to the data provider;

[0157] The acquisition module 301 is used for, in response to receiving the new SQL statement, calling a local database engine to acquire multiple values ​​to be aggregated according to the UDAF expression in the new SQL statement;

[0158] The selection module 302 is used to select a target value corresponding to the target quantile from the multiple values ​​using the differential privacy index mechanism through the database engine.

[0159] The present disclosure also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the above-mentioned quantile differential privacy noise adding method provided by the present disclosure.

[0160] The present disclosure also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned quantile differential privacy noising method provided by the present disclosure.

[0161] Reference below Figure 7 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0162] like Figure 7As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0163] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0164] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0165] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0166] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0167] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0168] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains multiple values ​​to be aggregated according to the expression of a preset user-defined aggregation function UDAF, wherein the UDAF is obtained by pre-replacing the quantile function, and the parameters of the UDAF and the quantile function both include the expression and the target quantile; uses the differential privacy index mechanism to select a target value corresponding to the target quantile from the multiple values ​​to obtain the noisy quantile value of the quantile function.

[0169] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0170] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0171] The modules described in the embodiments of the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the selection module may also be described as "a module for selecting a target value corresponding to the target quantile from the multiple values ​​using a differential privacy index mechanism to obtain a quantile value of the quantile function after noise addition".

[0172] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0173] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0174] According to one or more embodiments of the present disclosure, Example 1 provides a quantile differential privacy noise adding method, the method comprising:

[0175] According to an expression of a preset user-defined aggregation function UDAF, a plurality of values ​​to be aggregated are obtained, wherein the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function both include the expression and a target quantile;

[0176] A target value corresponding to the target quantile is selected from the multiple values ​​by using a differential privacy index mechanism to obtain a noisy quantile value of the quantile function.

[0177] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein the step of selecting a target value corresponding to the target quantile from the multiple values ​​using a differential privacy index mechanism includes:

[0178] Counting the frequency of occurrence of each of the values, and constructing a value-frequency pair according to the frequency of occurrence of each of the values;

[0179] Arrange the value-frequency pairs in order from small to large value;

[0180] A target value corresponding to the target quantile is selected from the value-frequency pairs obtained after sorting using a differential privacy index mechanism.

[0181] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein the method of selecting a target value corresponding to the target quantile from the value-frequency pairs obtained after sorting using a differential privacy index mechanism includes:

[0182] Determine the sorting position of each of the values ​​according to the value-frequency pairs obtained after sorting, wherein the sorting position is used to represent the position of the corresponding value when the multiple values ​​are sorted from small to large;

[0183] Determining a utility function of a differential privacy index mechanism and a sensitivity of the utility function according to a ranking position of each of the numerical values ​​and the target quantile;

[0184] Determining a target position of the target value according to the utility function and the sensitivity;

[0185] According to the target position, the target value is determined from the value-frequency pairs obtained after the sorting.

[0186] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, wherein determining the utility function of the differential privacy index mechanism and the sensitivity of the utility function according to the ranking position of each of the numerical values ​​and the target quantile includes:

[0187] Determining the number of the plurality of values ​​according to the occurrence frequency of each of the values;

[0188] Determining a quantile position corresponding to the target quantile according to the target quantile and the quantity;

[0189] respectively calculating the distance between each of the ranking positions and the quantile position;

[0190] According to all the distances, construct a utility function of the differential privacy index mechanism so that a result of the utility function is negatively correlated with the distance;

[0191] The sensitivity of the utility function is calculated.

[0192] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 3, wherein determining the target position of the target value according to the utility function and the sensitivity includes:

[0193] determining a plurality of candidate positions from among all of the ranked positions;

[0194] For each of the candidate positions, determining a selection probability of the candidate position according to the utility function and the sensitivity;

[0195] According to the respective selection probabilities of the multiple candidate positions, a candidate position is randomly selected from the multiple candidate positions as the target position.

[0196] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 5, wherein determining a plurality of candidate positions from all the sorted positions includes:

[0197] The sorted positions whose distances from the quantile positions corresponding to the target quantiles are less than a preset distance are determined as the candidate positions.

[0198] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 6, wherein determining a plurality of candidate positions from all the sorted positions further includes:

[0199] If the current number of the candidate positions is less than a preset number, the percentile positions of the target number are determined as the candidate positions, wherein the target number is equal to the difference between the preset number and the current number.

[0200] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 3, wherein determining the target value from the value-frequency pairs obtained after the sorting according to the target position includes:

[0201] A value corresponding to the target position is determined from the value-frequency pairs obtained after the sorting as the target value.

[0202] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 3, wherein determining the target value from the value-frequency pairs obtained after the sorting according to the target position includes:

[0203] Determining a value corresponding to the target position from the value-frequency pairs obtained after the sorting as a first value;

[0204] If the first value is not from the last value-frequency pair among the value-frequency pairs obtained after the sorting, then determining a value corresponding to the next position of the target position from the value-frequency pairs obtained after the sorting as the second value, and generating a random number in the range of (0, 1);

[0205] Performing a perturbation process on the difference between the second value and the first value by using the random number;

[0206] The sum of the disturbance processing result and the first value is determined as the target value.

[0207] According to one or more embodiments of the present disclosure, Example 10 provides the method of Example 9, wherein determining the target value from the value-frequency pairs obtained after the sorting according to the target position further includes:

[0208] If the first value comes from the last value-frequency pair, the first value is determined as the target value.

[0209] According to one or more embodiments of the present disclosure, Example 11 provides the method described in any one of Examples 1-10, where the method is applied to a data provider, and the method further includes:

[0210] In response to receiving a structured query language SQL statement, sending the SQL statement to a noise adding service provider, so that the noise adding service provider identifies a noise point in the SQL statement, replaces a quantile function belonging to the noise point with the UDAF, obtains a new SQL statement, and sends the new SQL statement to the data provider;

[0211] The step of obtaining multiple values ​​to be aggregated according to the expression of the preset user-defined aggregation function UDAF includes:

[0212] In response to receiving the new SQL statement, calling a local database engine to obtain multiple values ​​to be aggregated according to the UDAF expression in the new SQL statement;

[0213] The selecting a target value corresponding to the target quantile from the multiple values ​​by using a differential privacy index mechanism includes:

[0214] A target value corresponding to the target quantile is selected from the multiple values ​​by the database engine using a differential privacy index mechanism.

[0215] According to one or more embodiments of the present disclosure, Example 12 provides a quantile differential privacy noise adding device, the device comprising:

[0216] An acquisition module, used for acquiring multiple values ​​to be aggregated according to an expression of a preset user-defined aggregation function UDAF, wherein the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function both include the expression and the target quantile;

[0217] A selection module is used to select a target value corresponding to the target quantile from the multiple values ​​by using a differential privacy index mechanism to obtain a noisy quantile value of the quantile function.

[0218] According to one or more embodiments of the present disclosure, Example 13 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-11 when executed by a processing device.

[0219] According to one or more embodiments of the present disclosure, Example 14 provides an electronic device, including:

[0220] a storage device having a computer program stored thereon;

[0221] A processing device is used to execute the computer program in the storage device to implement the steps of the method described in any one of Examples 1-11.

[0222] According to one or more embodiments of the present disclosure, Example 15 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-11 when executed by a processor.

[0223] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0224] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0225] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A quantile differential privacy noise adding method, characterized in that: The method comprises: According to an expression of a preset user-defined aggregation function UDAF, a plurality of values ​​to be aggregated are obtained, wherein the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function both include the expression and a target quantile; A target value corresponding to the target quantile is selected from the multiple values ​​by using a differential privacy index mechanism to obtain a noisy quantile value of the quantile function.

2. The method according to claim 1, characterized in that The selecting a target value corresponding to the target quantile from the multiple values ​​by using a differential privacy index mechanism includes: Counting the frequency of occurrence of each of the values, and constructing a value-frequency pair according to the frequency of occurrence of each of the values; Arrange the value-frequency pairs in order from small to large value; A target value corresponding to the target quantile is selected from the value-frequency pairs obtained after sorting using a differential privacy index mechanism.

3. The method according to claim 2, characterized in that The method of selecting a target value corresponding to the target quantile from the value-frequency pairs obtained after sorting by using the differential privacy index mechanism includes: Determine the sorting position of each of the values ​​according to the value-frequency pairs obtained after sorting, wherein the sorting position is used to represent the position of the corresponding value when the multiple values ​​are sorted from small to large; Determining a utility function of a differential privacy index mechanism and a sensitivity of the utility function according to a ranking position of each of the numerical values ​​and the target quantile; Determining a target position of the target value according to the utility function and the sensitivity; According to the target position, the target value is determined from the value-frequency pairs obtained after the sorting.

4. The method according to claim 3, characterized in that Determining the utility function of the differential privacy index mechanism and the sensitivity of the utility function according to the ranking position of each of the values ​​and the target quantile includes: Determining the number of the plurality of values ​​according to the occurrence frequency of each of the values; Determining a quantile position corresponding to the target quantile according to the target quantile and the quantity; respectively calculating the distance between each of the ranking positions and the quantile position; According to all the distances, construct a utility function of the differential privacy index mechanism so that a result of the utility function is negatively correlated with the distance; The sensitivity of the utility function is calculated.

5. The method according to claim 3, characterized in that: Determining the target position of the target value according to the utility function and the sensitivity includes: determining a plurality of candidate positions from among all of the ranked positions; For each of the candidate positions, determining a selection probability of the candidate position according to the utility function and the sensitivity; According to the respective selection probabilities of the multiple candidate positions, a candidate position is randomly selected from the multiple candidate positions as the target position.

6. The method according to claim 5, characterized in that The step of determining a plurality of candidate positions from all the sorted positions comprises: The sorted positions whose distances from the quantile positions corresponding to the target quantiles are less than a preset distance are determined as the candidate positions.

7. The method according to claim 6, characterized in that The determining of a plurality of candidate positions from all the sorted positions further comprises: If the current number of the candidate positions is less than a preset number, the percentile positions of the target number are determined as the candidate positions, wherein the target number is equal to the difference between the preset number and the current number.

8. The method according to claim 3, characterized in that The step of determining the target value from the value-frequency pairs obtained after the sorting according to the target position includes: A value corresponding to the target position is determined from the value-frequency pairs obtained after the sorting as the target value.

9. The method according to claim 3, characterized in that: The step of determining the target value from the value-frequency pairs obtained after the sorting according to the target position includes: Determining a value corresponding to the target position from the value-frequency pairs obtained after the sorting as a first value; If the first value is not from the last value-frequency pair among the value-frequency pairs obtained after the sorting, then determining a value corresponding to the next position of the target position from the value-frequency pairs obtained after the sorting as the second value, and generating a random number in the range of (0, 1); Performing a perturbation process on the difference between the second value and the first value by using the random number; The sum of the disturbance processing result and the first value is determined as the target value.

10. The method according to claim 9, characterized in that The step of determining the target value from the value-frequency pairs obtained after the sorting according to the target position further includes: If the first value comes from the last value-frequency pair, the first value is determined as the target value.

11. The method according to any one of claims 1 to 10, characterized in that The method is applied to a data provider, and the method further includes: In response to receiving a structured query language SQL statement, sending the SQL statement to a noise adding service provider, so that the noise adding service provider identifies a noise point in the SQL statement, replaces a quantile function belonging to the noise point with the UDAF, obtains a new SQL statement, and sends the new SQL statement to the data provider; The step of obtaining multiple values ​​to be aggregated according to the expression of the preset user-defined aggregation function UDAF includes: In response to receiving the new SQL statement, calling a local database engine to obtain multiple values ​​to be aggregated according to the UDAF expression in the new SQL statement; The selecting a target value corresponding to the target quantile from the multiple values ​​by using a differential privacy index mechanism includes: A target value corresponding to the target quantile is selected from the multiple values ​​by the database engine using a differential privacy index mechanism.

12. A quantile differential privacy noise adding device, characterized in that: The device comprises: An acquisition module, used for acquiring multiple values ​​to be aggregated according to an expression of a preset user-defined aggregation function UDAF, wherein the UDAF is obtained by replacing a quantile function in advance, and parameters of the UDAF and the quantile function both include the expression and the target quantile; A selection module is used to select a target value corresponding to the target quantile from the multiple values ​​by using a differential privacy index mechanism to obtain a noisy quantile value of the quantile function.

13. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 11 are implemented.

14. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 11.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images